Five changes are live. You can now publish security advisories from a resolved report, set your own response targets, draft every Article 14 notification field per stage, run your portal in German, and see version-aware SBOM exposure.
Publish a security advisory from a resolved report
When you resolve a submission, you can now turn it into a public advisory. You draft it in the dashboard, then publish it when you are ready. Nothing goes public until you publish.
Published advisories appear on your portal in their own list. Each advisory has its own page. The list also has an RSS feed, so customers and researchers can follow your releases. Each advisory can also be downloaded as a CSAF VEX document, which customer tools can read automatically.
If you work with a CVE Numbering Authority, you can record the CVE state of each advisory. It moves forward from requested to reserved to published, and the CVE ID goes into the CSAF document.
Advisory pages are free on every plan. The CSAF download needs a paid plan. CVE tracking is on the Enterprise plan.
Where to find it: Submissions, then open a resolved submission, then Draft public advisory.
Set your own response targets and resolution deadlines
Until now every portal used a fixed 48-hour acknowledgment window and a fixed 10-business-day triage window. You can now set your own targets. The portal uses them to flag reports that need attention, and your public disclosure policy shows the windows you commit to.
You can also set a resolution deadline for each severity. Each submission then shows a badge that tells you if it is on track, due soon, breached or met.
Custom response targets need a paid plan. Resolution deadlines are on the Enterprise plan.
Where to find it: Settings, then General, then Response Time Targets and Resolution SLAs.
Draft every Article 14 field, stage by stage
The Article 14 report now covers the fields that ENISA's Single Reporting Platform asks for at each stage. These are the 24-hour early warning, the 72-hour notification and the final report. You fill in the fields once, and they carry forward to the next stage. Each field shows its platform reference.
If a field that a stage requires is empty, the portal tells you which one before it generates the report. When you download a report again, you get the exact version you generated before, not a new one. Article 14 report drafting needs a paid plan.
Where to find it: Submissions, then open a submission, then the Severity & Art.14 Obligations card.
Run your public portal in German
Your public portal can now show in German. This includes the landing page, the submission form, the disclosure policy and the advisories. English stays the default. You can write a German version of your disclosure policy next to the English one, and you can give each advisory a German title and summary.
Where to find it: Settings, then General, then Portal language. Write the German policy in Settings, then PGP / Security.
See which SBOM components are really exposed
Supply Chain Intel used to list every vulnerability ever filed against a package, whatever version you ship. It now checks each component in your SBOM against the open OSV.dev database at the exact version you use. You see one ranked list of the vulnerabilities that affect your versions.
The panel also tells you how many of your components it could check. A component without a package ecosystem, for example one with no package URL in your SBOM, cannot be matched. Add package URLs to your SBOM to get the best coverage. SBOM exposure needs a paid plan.
Where to find it: Supply Chain Intel, then SBOM Exposure.
What has not changed
If you do not set response targets, the 48-hour and 10-business-day windows stay in place. Your portal stays in English until you choose German. No advisory is published unless you publish it.